What a random number generator is, and how testing houses certify one

The basic idea behind an RNG

A random number generator (RNG) is a piece of software that produces sequences of numbers with no predictable pattern. In gambling technology, those numbers are mapped onto outcomes: which card is dealt, where the roulette ball lands, which symbols appear on a slot reel, or what the cards look like in a shuffled deck for online poker.

Most gambling RNGs are what’s known as pseudo-random number generators (PRNGs). They are not truly random in the way radioactive decay or atmospheric noise is random; instead they use a mathematical algorithm and a starting value, called a seed, to generate long sequences of numbers that behave statistically like random data. A good PRNG produces results that pass every standard statistical test for randomness, cannot feasibly be predicted even if you know previous outputs, and does not repeat within any realistic timeframe of play.

Some systems use true random number generators (TRNGs), which draw entropy from a physical, unpredictable source such as electronic noise, rather than a formula. TRNGs are more common in cryptography and high-security applications, but reputable PRNGs used in gambling are considered cryptographically secure and are treated as fit for purpose by regulators, provided they are properly tested.

Why the seed and algorithm matter

The integrity of an RNG rests on two things: the strength of the algorithm and the unpredictability of the seed. If the seed can be guessed or reconstructed, for example because it is derived from something predictable like the system clock in a naive way, the whole sequence of outputs could theoretically be reverse-engineered. This is why serious testing focuses heavily on seeding methods, not just the output numbers themselves.

An RNG also needs to avoid what statisticians call bias: a tendency for some outcomes to occur more often than pure chance would allow. Even a tiny bias, invisible over a few hundred spins, can become a measurable and exploitable edge over millions of rounds. This is one of the key things independent testing houses are built to detect.

What an RNG actually controls in a game

It helps to be clear about scope. An RNG decides the raw outcome, but a game’s return to player (RTP) and volatility are determined by how the game’s paytable and rules are built around that outcome, not by the RNG itself. A fair RNG can sit behind a game with any RTP; testing the RNG confirms the numbers are unpredictable and unbiased, while separate mathematical testing confirms the game’s payout model matches what has been advertised or submitted to the regulator. Both checks are usually done by the same testing house as part of a single certification process.

How independent testing houses certify an RNG

Gambling regulators generally do not test software themselves. Instead they require operators and suppliers to use accredited independent testing laboratories, sometimes called test houses or ITLs, which examine the RNG and the wider game logic before a licence or certificate is issued.

A typical certification process includes:

• Source code and design review. Testers examine how the RNG is implemented, how it is seeded, and how outputs are converted into game results, checking for any point where predictability or manipulation could creep in.
• Statistical testing. The RNG’s output is run through established statistical test suites designed to detect non-randomness, patterns, correlations or bias across huge volumes of generated numbers.
• Long-run simulation. Testers simulate millions or billions of game rounds to confirm that the actual return to player and volatility match the theoretical model submitted by the supplier.
• Security and tamper checks. Labs assess whether the RNG or its outputs could be altered after certification, including checks on how updates and patches are controlled and logged.
• Ongoing and periodic retesting. Because software changes, certification is not a one-off event. Games and platforms are typically retested after significant updates, and operators must be able to show a live game matches the version that was originally certified.

Only after passing this process does a testing house issue a certificate, which the operator or supplier can then submit to a regulator such as the Gambling Commission as evidence that a game meets required fairness and technical standards.

Why this matters for players and the industry

For players, RNG certification is one of the main practical guarantees that a game is not rigged and that stated odds and returns are genuinely representative of what will happen over time. For operators and suppliers, it is a licensing requirement rather than an optional quality mark: in a regulated market, distributing an uncertified RNG-driven game is not permitted.

For a trade audience, the detail worth watching is less the existence of certification and more its currency. A certificate tied to an old version of a game is not proof the live version in market is still compliant, which is why reputable suppliers keep testing house documentation current whenever they patch or update a title, and why operators are expected to check that the version they are running matches what was actually tested.

Anyone wanting to understand a specific jurisdiction’s technical standards, or to check which testing houses are recognised in a given market, should go to the primary regulator rather than rely on marketing claims from a supplier, since accreditation requirements and recognised laboratories do change over time.

Where to check current standards

Rules on which testing houses are recognised, and what technical standards an RNG must meet, vary by jurisdiction and are updated periodically, so always check the current position with the relevant regulator rather than relying on older commentary.